The promotion of data sharing in pharmacoepidemiology.

Europe PMC Funders Group Author Manuscript Eur J Health Law. Author manuscript; available in PMC 2014 November 25. Published in final edited form as: Eur J Health Law. 2014 June ; 21(3): 271–296.

Europe PMC Funders Author Manuscripts

The Promotion of Data Sharing in Pharmacoepidemiology Nayha Sethi Research Fellow, School of Law, University of Edinburgh, UK

Abstract This article addresses the role of pharmacoepidemiology in patient safety and the crucial role of data sharing in ensuring that such activities occur. Against the backdrop of proposed reforms of European data protection legislation, it considers whether the current legislative landscape adequately facilitates this essential data sharing. It is argued that rather than maximising and promoting the benefits of such activities by facilitating data sharing, current and proposed legislative landscapes hamper these vital activities. The article posits that current and proposed data protection approaches to pharmacoepidemiology — and more broadly, re-uses of data — should be reoriented towards enabling these important safety enhancing activities. Two potential solutions are offered: 1) a dedicated working party on data reuse for health research and 2) the introduction of new, dedicated legislation.

Keywords pharmacoepidemiology; secondary uses; data reuse; health research; data protection; data sharing


1 Introduction This article posits that a responsive, adaptable and flexible approach to data reuse for research is imperative for patient safety, and uses pharmacoepidemiological research as a case-study to do so. Pharmacoepidemiological research provides an important case-study because it straddles the divide between traditional monitoring of patient safety, within pharmacovigilance and wider reuse of health data in the research setting, which also contributes significantly towards ensuring patient safety. It is argued that current categorisations within the law of different conditions of health data reuse present an artificial distinction between such interrelated activities. The article begins by considering pharmacoepidemiology and the numerous benefits of the discipline in terms of enhancing patient safety. The crucial importance of patient data to these activities is highlighted. Self-evidently, the more accurate, complete and readily available these data are, the clearer the picture about medicine safety and efficacy becomes. Data protection legislation and the related obligations to which it gives rise play a fundamental role in determining whether access to data is granted and under which circumstances. Given the reliance on data and the proposed legislative changes to data protection legislation which are currently under consideration within the European Union, it is timely to consider whether the current legislative landscape adequately facilitates pharmacoepidemiological activities and whether proposed changes will also do so, or change the dynamic for ill.

Sethi

Page 2


It is argued here that rather than maximising the benefits of such activities by enabling sharing, the current and proposed legislative landscapes are unnecessarily inhibitive. This manifestly does not reflect the public interest in scientifically sound medical research and in ensuring patient safety. Nor does it appreciate the obstructive effects which arbitrary categorisation of data sharing activities can have. It is proposed here that the law can be framed so as to act as an enabler, and a cultural driver for sharing in appropriate circumstances. This does not denigrate the important role of the law in inhibiting inappropriate data sharing, however a balance must be achieved, rather than the current status quo where data reuse is often prevented even in ethically and scientifically sound projects and despite the fact that patient safety stands to benefit. Responsive, adaptive and operationalisable solutions are required. Two options for improving the situation are briefly outlined: the first comes in the form of a dedicated working party tasked with considering issues arising from reuse of health data for research; the second is a proposal for new legislative provision that specifically addresses data reuse for research. First, a preliminary note; reference is often made within the health research literature to ‘secondary uses of data’ this is to say, data ‘initially collected for another purpose’.1 While this might seem to be simply a matter of semantics, it is argued here that reference to the term ‘secondary uses’, is unhelpful and antithetical to one of the key messages in this article, viz, that such data reuses are valuable and merit due recognition and, when appropriate, prioritisation. The language that we use is all-important because the term ‘secondary use’ tends to imply ‘inferior’ use. A more helpful framing might be achieved via rephrasing ‘secondary uses’ of data to ‘data reuse’. Accordingly, the term ‘data reuse’ is used throughout this article.

2 Pharmacoepidemiology: An Overview Europe PMC Funders Author Manuscripts

This initial section considers the crucial role which pharmacoepidemiology plays in patient safety and why data access is key in facilitating such activities. First, however, a brief summary of what pharmacoepidemiology entails, and how it has developed since its emergence is offered. 2.1 What Is Pharmacoepidemiology? Pharmacoepidemiology is ‘the study of the use, and effects, of drugs and other medical devices in large numbers of people’,2 ‘it aims to examine all detectable effects, whether beneficial or adverse’.3 It encompasses many activities including the study of adverse drug reactions (ADRS). An adverse drug reaction is described as: an unwanted or harmful reaction experienced following the administration of a drug or combination of drugs under normal conditions of use, which is suspected to be related to the drug. The reaction may be a known side effect of the drug or it may be new and previously unrecognised.4 Pharmacoepidemiology is considered for present purposes, as the study of the use of effects of drugs amongst large populations after a drug has received its licence, in the postmarketing phase.5

Eur J Health Law. Author manuscript; available in PMC 2014 November 25.

Sethi

Page 3


Few laws existed to regulate drug marketing and development at the time of the Thalidomide revelations6,7 and a clear need for addressing drug safety issues was identified, guidelines were developed across different countries in order to monitor drugs for ADRS. Examples include: the US Kefauver-Harris Amendments8 the UK Yellow Card Scheme9 and Directive 65/65/EEC to safeguard public health concerning production and distribution of medicinal products.10 Subsequently, a plethora of legislation has emerged,11 rendering patient safety a core aspect of drug development and research. Numerous national level pharmacoepidemiology centres and coordinated research initiatives exist.12,13,14 Whilst drug surveillance has significantly enhanced patient safety, the prevalence and under-reporting of ADRS remains.15,16 2.2 Why Is Pharmacoepidemiology so Important for Patient Safety?


Pharmacoepidemiological studies are integral to patient safety, when a drug is available to the wider population and throughout the lifetime of each patient who consumes the medication. Studies affect other patients with similar illnesses by influencing the availability of such drugs and the ability to make informed decisions about drug suitability given knowledge about patient experiences. Without pharmacoepidemiology, our understanding of the safety and efficacy of medicines is limited; such studies offer a much more complete picture about drugs and allow us to detect risks which would only appear when a large number of individuals have been exposed to a medicine. Clinical trials typically exclude or have limited involvement of certain population groups17,18,19,20 rendering extrapolation of results to these groups in the population at large particularly difficult.21,22 Clinical trials traditionally occur over limited time periods. Pharmacoepidemiology enables us to monitor the efficiency, effects and risks of a drug in the longer-term.23 We can also learn how drugs react with each other in patients with co-morbidities (also typically and routinely excluded from clinical trials).24 Pharmacoepidemiological studies can lead to withdrawal of a drug from the market and changes to the product label, indications for use and terms of availability.25 Additionally, such studies reveal unexpected benefits leading to use for treatment of diseases other than those for which the drug was originally developed, i.e., serendipitous drug discovery.26,27,28

3 Data as a Key Component in Patient Safety More accurate, accessible, and complete data offer more complete drug profiles which increase patient safety and facilitate the benefits of cost efficiency. Data sharing also plays a key role to ‘accelerate health improvements’ more generally.29 To fully appreciate the critical role which data play in enabling such activities, an overview of some methods and sources of data which pharmacoepidemiological studies rely upon is helpful. 3.1 Spontaneous Reporting (SR) Spontaneous Reporting(SR) is a flawed but essential tool used to flag ADRS.30 In the UK, doctors are obliged to report ADRS31 and patients can report them via the Yellow Card Scheme,32 particularly important as prescribing for children can often be off-label.33 Underreporting of ADRS is problematic,34,35 due to failure to associate the ADR with the new drug36 or to understand when an ADR should be reported.37 This can be a challenge across


Sethi

Page 4


the EU.38,39,40 Whilst all ADRS must be reported for black triangle status drugs, for established drugs, only serious ADRS must be reported, leaving a significant gap in knowledge about more minor ADRS.41,42 SR ‘offers low evidence of risks associated with medicines’ but the ‘highest levels of uncertainty regarding causality’.43,44,45 If we are to achieve a reliable evidence base for serious and minor ADRS, and offer more certainty than that a drug is ‘apparently safe based on partial information’,46 then we must go well beyond SR. 3.2 Data Linkage (DL) One method employed in pharmacoepidemiology, particularly significant here, is data linkage, which ‘…brings together information from two or more records from independent sources that are perceived to belong to the same individual, family, event or place’.47 DL relies upon reuse and linking of data sources such as: electronic health records; routinely collected administrative data such as prescribing data, hospital admissions, mortality and morbidity data, cancer registries etc.48 Reusing data has many strengths, including that data are ‘collected prospectively without knowing the research question issues of bias.’49 DL provides a cost-effective means of analysing pre-collected data and wielding results that may not be possible or ethically or economically viable in other settings such as clinical trials.50 Such studies can involve linking several different datasets. Numerous national and European initiatives are dedicated to maximising the research potential of reusing data for health research.51 Database studies are conducted throughout North America and Europe.52,53,54


The major funding councils in the UK have collaborated on a £19 million funding call reflecting their appreciation of the importance of ‘the health research potential offered by linking electronic health records with other forms of routinely collected data and research datasets’.55 Indeed, the new UK-network of health linkage centres — the ‘Farr Institute’ — has been established to ‘deliver high-quality, cutting-edge research linking electronic health data with other forms of research and routinely collected data’.56 Through data linkage, pharmacoepidemiological activities straddle questions of patient safety both immediately after a drug has been licensed, but also in the long-term, where studies involve linkage of numerous data sets on large populations over significant time periods. Whilst major research funders appear to be moving in the direction of promoting and prioritising such research, the legislative regime(s) in this area are lagging behind, hampering these crucial activities, let us consider how.

4 Data Governance Regime: Losing Sight of Priorities Although data linkage brings with it many advantages, including access to data which are already collected and which can be traced over long periods of time, reuse of data for data linkage purposes faces significant regulatory hurdles. This next section considers the regulatory hurdles currently inhibiting studies aimed at improving patient safety. Detailed accounts laying out the legislative landscape governing reuse of health data are recounted elsewhere.57 A summary of the problems with the current landscape as a whole sets the scene.


Sethi

Page 5

4.1 Current Governance Regime


The key message from literature discussing governance of reuse of health data is clear: the current landscape is complex and unduly burdensome.58 That the European Data Protection Directive (EuDPD) is open to interpretation by Member States (of the EU) perpetuates divergent approaches to data sharing across the European Union.59 The disproportionate procedures which researchers must navigate to access data are also well documented.60 A particular issue is the myriad, often repetitive and time-consuming approvals procedures which must be fulfilled prior to data access.61 The point is not that approvals procedures are unnecessary. On the contrary, ensuring that robust and proportionate legal and ethical standards are met both prior to and during the use of sensitive data is non-negotiable. What is crucial is that any standards which must be met — including data access and approval procedures — are appropriate to the level of perceived risk associated with a study. Equally, such standards should reflect the important goal of facilitating important health research which can contribute to patient safety, in line with the fundamental principle of ensuring the free flow of data — as provisioned in the EuDPD. It is paramount that legislation is not only operationalisable on a practical level, but that it enables data sharing in appropriate contexts, rather than prohibiting sharing, especially when prohibitions are based on artificial and impractical distinctions made in law. Let us consider, the dominant ‘consent or anonymise’ approach to current data reuse for health research in the UK.62 This is understood as implying that where patient consent cannot be obtained for using data for a research project, then the data should be anonymised by default. Obtaining consent is not always possible or practical, particularly when one considers:


…the cost of contacting hundreds of thousands, or even millions, of individuals. Or trying to reach them years after their health care encounter, when many may have relocated, some may have died, and some may not want to be reminded about an unpleasant of traumatic experience.63 Notwithstanding, and although anonymisation of data can facilitate research, the process can also be problematic. It is said, for example, that complete anonymisation or deidentification64 of data is in fact a myth,65 if not ‘very difficult to achieve in practice’.66 Moreover, ‘…the security of personal records in databases cannot be guaranteed through anonymisation procedures’.67 This being said, anonymisation can still considerably diminish the likelihood of re-identification where this is the desired goal.68 Rather than discussing the impossibility of re-identification of individuals, however, a more helpful and realistic framing of the discussion might be around likelihood69 of re-identification as opposed to judgements being made around possibility of re-identification; if we accept that anonymisation is a myth, then re-identification would always be possible, this offers a perfect example of an impractical categorisation within the legislative landscape. Indeed, eradicating the possibility of re-identification is not always the desired practical goal; an important aspect of pharmacoepidemiological and more general70 data linkage research is traceability of data. This enables longitudinal studies which track the effects of medication over a patient’s lifetime, drug safety issues may only arise after: a period of time, Eur J Health Law. Author manuscript; available in PMC 2014 November 25.

Sethi

Page 6


the development of new illnesses and/or the introduction of new medications to the patient. Re-identification of patients may be necessary ‘when clinically relevant information arises during the course of a study which might have a direct impact on the treatment of a patient. In such cases, ethical principles demand recontacting and informing all relevant patients about the findings’.71 Further, traceability facilitates follow up studies of cohorts. Traceability implies that the patients are either identifiable, or that their data are pseudonymised, so that re-identification is possible. Pseudonymisation is one mechanism which does enable traceability whilst alleviating some concerns around using identifiable data. This is ‘the process of distinguishing individuals in a dataset by using a unique identifier which does not reveal their ‘real world’ identity.’72 It is considered a ‘powerful and flexible tool for privacy protection in databases’. It allows ‘linking data associated with the true individual, through the pseudo-IDS, irrespective of the collection time and place’.73 Pseudonymisation is one of several mechanisms which speak to current flexibilities around conducting data linkage74 however, even here, challenges exist. The extent to which pseudonymisation is (in)effective will depend upon the techniques used and the specific contexts of the research/data use.75 The method may ‘not be adequate for many research purposes’.76


Two important points can be made here. First, the lines between anonymous, pseudonymous and personal data are not clear cut. Current legislation unhelpfully assumes that these distinctions can be made easily, which is not the practical reality. Further, it is argued that we cannot and should not simply rely on technical processes to remedy the problems plaguing reuses of health data. Indeed, reliance on technical processes in turn gives rise to confusion around definitions and around which techniques are acceptable to satisfy thresholds of ‘anonymisation’, ‘pseudonymisation’ and relatedly, to what counts as ‘personal data’.77 We need to consider the purposes, contexts78 and value of reusing health data. It has been suggested that the confusing landscape governing data reuse, which makes difficult demands on researchers and data custodians in negotiating with ill-defined terms, has led to a culture of caution, with fear of sanctions for data sharing which may actually not be inappropriate.79 The focus here is on the effects of data protection legislation on conducting pharmacoepidemiological — and more broadly — health research through data reuse. However, it is also important to acknowledge that cultural attitudes and practices towards data reuse must play an undeniable role in how data are used,80 but equally, the law plays a significant role in shaping the regulatory landscape. Consequently, a clearer, flexible and practicable framing of data reuse is required. Another solution which does accommodate consideration of the purposes of reuse involves taking principled proportionate approaches to governance, as I have argued elsewhere.81 One example of taking such an approach is via authorisation, whereby a proxy decisionmaker in the form of an individual or body can authorise a linkage. However, pre-existing mechanisms within the current landscape which facilitate data linkage are limited. Further, the flexibility currently offered by pseudonymisation, which facilitates many significant studies based on reuse of health data is put at risk in the proposed Data Protection Regulation.82


Sethi

Page 7

4.2 Proposed Legislative Reform: What Is Around The Corner?


We have briefly considered above the current regulatory landscape governing the reuse of data for research, concluding that a regulatory approach which better promotes sharing data in appropriate circumstances is needed. The EuDPD was drafted at a time when the use of the Internet to share and collate data was in a nascent stage.83 Internet use has proliferated, alongside globalisation, technical advances and the numerous internet-related privacy scandals in news headlines. Issues of transfer of data to countries outside the EU have also emerged.84 It has become clear that the current Directive is no longer fit for purpose.85 Legislative reform is underway and rather than adopting another directive, a regulation has been proposed to replace the ‘patchwork of national laws with a single set of rules’.86 A robust analysis of the proposed legislation is not offered here, given that full agreement has not yet been reached on the final text. Rather, this section considers which direction the current text (which has just been approved by the European Parliament) might steer data reuse towards, concluding that if the European Council approves the current text, the end point for such research could be even worse than the current unacceptable situation.


The initial draft proposal of the General Data Protection Regulation was advanced by the European Commission in January 2012.87 Two years and several delays later, it has still not been adopted; unsurprising when we consider the myriad stakeholder concerns involved. The drafters have been charged with the unenviable task of legislating on a wide range of data protection issues. Whilst the proposed Regulation could help to clarify issues around the processing of personal data for the purposes of monitoring drug safety pre-marketing,88 it is argued here that an opportunity is being missed in improving how data reuse in postmarketing pharmacoepidemiological studies and wider health research — also integral for patient safety — can take place. The lead Committee on Civil Liberties, Justice and Home Affairs (LIBE) voted to adopt recommendations from Rapporteur Albrecht (the Albrecht Report)89 which proposed numerous amendments to the Regulation. Certain amendments, which were proposed in January 2013, have raised significant concerns amongst the research community.90,91 The European Parliament has approved the amended text which appears to be missing out on the opportunity of realigning the due regard for one of the fundamental principles upon which the EuDPD was originally founded; the free flow of data which corresponds to promoting sharing data in appropriate circumstances. The draft Regulation includes clear acknowledgement that: The centrepiece of existing EU legislation on personal data protection, Directive 95/46/EC3, was adopted in 1995 with two objectives in mind: to protect the fundamental right to data protection and to guarantee the free flow of personal data between Member States.92 Further, ‘[t]he current framework remains sound as far as its objectives and principles are concerned’,93 references to achieving the dual objectives of data protection and ensuring the free flow of data are made throughout the draft Regulation. Indeed, the very wording of the Regulation title is ‘Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free


Sethi

Page 8


movement of such data’.94 It is argued here that despite such explicit articulations of the dual goals of protecting privacy and promoting free movement of data, the clearly important role of protecting individual privacy rights distracts from the equally important goal of facilitating data sharing, in this case, facilitating the reuse of data for patient safety and health research. Let us consider in more detail the relevant provisions and amendments to the draft regulation, (which emanated from the Albrecht Report) to demonstrate how this is so. The Albrecht Report proposed (and Parliament agreed) that Article 81 of the original draft Regulation be revised to read as follows: Processing of personal data concerning health which is necessary for historical, statistical or scientific research purposes, shall be permitted only with the consent of the data subject,95 and shall be subject to the conditions and safeguards referred to in Article 83.96 It is not clear to this author precisely where pharmacoepidemiological studies which aim to investigate long-term post-marketing effects of drugs fits in the legislation. If such studies are viewed as fitting under ‘scientific research purposes’ as many data linkage studies are, then the implications of this amendment would be that research using identifiable data where consent has not been obtained will be prevented. Article 7 of the Albrecht Report requires consent to be “specific, informed and explicit”. The (im)practicalities around obtaining consent97 and the over-reliance of consent as a panacea to all potential privacy concerns have been discussed at length elsewhere,98 but clear practical hurdles include resources such as time and budget to facilitate obtaining consent, if even possible. These barriers could prevent many studies going ahead.99


With regards to pseudonymisation, we considered above that this process provides at least some flexibility within the current landscape however there is a lack of sufficient clarity with regards to whether pseudonymised data will fall under the scope of ‘personal data.’100 This being said, a recent Art 29 DPWP Opinion on anonymisation has raised the bar with regards to anonymisation and suggests that pseudonymised data ‘stays inside the scope of the legal regime of data protection’.101 If the new regulation text is approved by the European Council, then “[t]he inclusion of pseudonymised data within the scope of ‘personal data’ could dramatically increase the regulatory burden on research.”102 This will place even tighter restrictions upon the extent to which these data can be reused. The UK Information Commissioner’s Office noted that if personal data is to be defined so as to include pseudonymised data, then ‘…it is important to be clear that a wide definition plus all the associated rules in full would not work in practice.’103 Another Albrecht amendment proposed that pseudonymised health data could be used without consent but only if the threshold of ‘exceptionally high public interest’ is met.104 Indeed, under Article 42 of the original draft Regulation: ‘historical, statistical and scientific research purposes’ were included as legitimate reasons for ‘derogating from the prohibition of processing sensitive categories of data’.105 The drafters of the Albrecht Report state:


Sethi

Page 9

Processing of sensitive data for historical, statistical and scientific research purposes is not as urgent or compelling as public health or social protection. Consequently, there is no need to introduce an exception which would put them on the same level as the other listed justifications.106


The clear value statement included in the quote above is problematic given the significant contributions pharmacoepidemiological studies make towards patient safety. Again, exactly where such research sits with regards to ‘scientific research’ or ‘public health’ is questionable and it is argued that the distinction, based on ‘urgency’ between the different uses of data is unhelpful and can lead to prohibiting important activities.


Thus far, we have considered why availability of health data is crucial for patient safety, as guaranteed by pharmacoepidemiological research. We have outlined some reasons why the current data protection regime is sub-optimal with regards to facilitating such activities. Key points which have emerged are that researchers can use different technical methods for privacy protection but none is free from issues: particularly given the fact that the more information which is joined together from different sources, the more the likelihood of identifiability will increase,107 as with ‘jigsaw’ techniques.108 Further, there is uncertainty and variance in practice around pseudonymisation techniques.109 Such observations serve as examples of how unhelpful it can be to focus solely on categorizing types of data and types of use when the ultimate goal of such studies is to ensure patient safety. Pharmacoepidemiology as we have considered, speaks to patient safety at different levels, not only in the context of pre-marketing surveillance of drug reactions, but also in the wider context of health research studies which focus on drug effects in wide populations over a sustained period of time, but nonetheless contribute significantly towards patient safety. We have briefly considered above the effects which the amended draft regulation might have on data reuse in health research if the European Council follows the Parliament in approving the text. It has been considered that proposed changes to the European framework may be particularly detrimental to realising the potential of data reuse in health research, especially if pharmacoepidemiological studies fit under ‘scientific research purposes’, if pseudonymisation is brought to fit under the scope of personal data and if explicit consent is required prior to data reuse for such data.

5 Reorienting the Research Path This final section suggests that a reorientation of how the reuse of data is prioritised within data protection legislation could improve the current situation. A role is envisaged for the law as an enabler of data sharing, where this is for scientifically and ethically robust reuse of patient data not only for pharmacoepidemiological research, but for wider health research. Two means of enacting this role are posited here: the first is in the form of the establishment of a dedicated Working Party on data reuse and the second in the form of bespoke legislation specifically aimed at data reuse for research. An overview of each is offered alongside reasons why these options might be considered.


Sethi

Page 10

5.1 The Establishment of a Dedicated Working Party on Data Reuse


Issues relating to reuse of health data for research are currently considered at an EU level by the Article 29 Data Protection Working Party (Art 29 DPWP). The Party was established in 1996 alongside the EuDPD. The Art 29 DPWP comprises of: ‘a representative of the supervisory authority (ies) designated by each EU country; a representative of the authority(ies) established for the EU institutions and bodies; a representative of the European Commission.’110 The Art 29 DPWP has delivered several opinions relating to data reuse. Thus far, notable opinions relate to consent111 and the roles of data controllers and processors.112 It is suggested here that establishing a dedicated Working Party, with a similar composition to Art 29 DPWP, but which is committed to considering purely those issues arising out of reuse of data for health related research, would offer significant benefits. First and foremost, such a group could deliver opinions which specifically respond to the challenges and concerns encountered by key actors who are reliant upon gaining access to health data for research purposes. Such opinions would also aid data custodians who are charged with the responsibility of determining when to share data. Under Article 30 of the EuDPD, Art 29 DPWP is charged with the following tasks:


1.

(a) examine any question covering the application of the national measures adopted under this Directive in order to contribute to the uniform application of such measures;

2.

(b) give the Commission an opinion on the level of protection in the Community and in third countries;

3.

(c) advise the Commission on any proposed amendment of this Directive, on any additional or specific measures to safeguard the rights and freedoms of natural persons with regard to the processing of personal data and on any other proposed Community measures affecting such rights and freedoms;

4.

(d) give an opinion on codes of conduct drawn up at Community level.113

It is proposed here that a new Data Reuse for Health Research Working Party would be charged with the above tasks as they relate to the new Data Protection Regulation should it be adopted. The Working Party could also be charged with clarifying whether pharmacoepidemiological studies are included in this sphere. Additional tasks of the Working Party would include: (a) drafting European level Guiding Principles of data reuse for health research, and (b) consulting on the potential for drafting new dedicated legislation governing health data reuse in research. Both of these tasks are considered next. 5.1.1 Guiding Principles and Best Practice—Introducing a key set of guiding principles, supported by examples of best practice context could provide many benefits for researchers and data custodians alike. Principles should be seen as fundamental starting points to guide deliberation and action.114 Principle-based approaches in this context are ‘the use of broadly-stated objectives, standards and values by which individuals and institutions should conduct themselves when using data for research purposes.’115 The merits of principle-based approaches in the health research context have been discussed


Sethi

Page 11

elsewhere.116 However, in order to help orient readers to the value which guiding principles could bring in this context, key points relating to adopting principle-based approaches to decision making are recounted here.


As we have considered, the complex legislative landscape is difficult to navigate. Overarching principles can offer clear articulations not only to guide action on everyday practices, but also to offer a set of standards against which conduct should be measured. This has been the approach adopted in the Scottish context of data reuse for health research by the Scottish Health Informatics Programme (SHIP).117 This Scotland-wide project which is dedicated to maximising the research potential of data reuse of electronic health records has adopted a set of Guiding Principles and Best Practice, subsequently endorsed by the Scottish Information Commissioner’s Office and adopted by the Scottish Government for its Data Linkage Framework.118 A set of Guiding Principles can provide decision-makers across the EU with ‘broad-based values and commonly-agreed objectives to determine through deliberation and reflection what action best fits in accordance with the particular value(s) advanced.119 Having a predetermined, clear set of values can compensate for the gaps in the law where a clear course of action for the situation at hand is not offered. It is impossible to legislate on every perceivable eventuality; principles offer flexibility and guidance where provisions are not provided within the law.120 Principles can help to provide transparency to decision-makers and to data subjects alike, about the standards against which conduct will be measured.


The very process of drafting key principles and consulting key stakeholders across the EU can be of value in itself. This iterative process has the potential to uncover previously overlooked challenges to data reuse, which nonetheless require attention and clarification. A Principle-based approach could also tend to the current gaps which pharmacoepidemiological research falls into, it would promote sharing in appropriate contexts rather than forcing the research community to guess whether their activities (for example pharmacoepidemiological studies) and the associated data fit within certain provisions. Common principles can engender ‘mutual respect between all stakeholders and participants’.121 It is necessary also to acknowledge some weaknesses of principle-based approaches. Principles have often been criticised for being vague and abstract in nature,122 leaving significant scope for interpretation,123 and a lack of prescription can give rise to confusion about how to interpret and apply principles.124 As Knoppers et al. note when considering principles: ‘…discussion on the nature of such principles and their procedural translation in different contexts will necessarily vary.’ However it is argued here that the benefits of offering over-arching principles at the European level which have been mentioned above outweigh the limitations associated with principles. 5.1.2 Consultation On New Legislation—The merits of new legislation are discussed in more detail below. Conducting a consultation on what this new legislation should and should not include could be one of the key tasks for the Working Party. It will be best


Sethi

Page 12

placed, having drafted guiding principles and having dealt with queries from Member States (of the EU), to draft an informed legislative proposal for wider consultation. 5.2 New and Dedicated Legislation Governing Data Reuse


This next suggestion for reorienting the landscape moves one step further: introducing legislation specifically on the reuse of health data for research is proposed. As mentioned above, reuse of data for health research is proliferating, and will continue to do so as we move towards establishing new and strengthening pre-existing e-health infrastructures. Rather than relying upon building-in provisions for reuse of data within a larger regulation such as the proposed Data Protection Regulation, it is worthwhile considering introducing legislation which from the outset, is designed to legislate on health data reuse in the research context. It is argued here that having clear legislative articulations dedicated to the specific context of data reuse is a necessary starting point and cultural change is unlikely to occur without explicit reference to the need for sharing such data. It has already been acknowledged above that revising, let alone drafting European-level legislation is by no means an easy feat, as exemplified by the duration of the drafting process for revisions to the current Directive. However, it is questionable whether this would be any more of an undertaking than the current ambitious task of revising the EuDPD as it stands. This proposal is for a clear and coherent Directive/Regulation which at its core, strives to enable data sharing activities to secure patient safety, and which acknowledges that this can occur in the context of wider pharmacoepidemiological research which necessitates reuse of patient data which does not only take place under pharmacovigilance activities.


Introducing new legislation is akin to taking a rule-based approach to regulation.125 This can offer more concreteness in comparison to principles and prescriptive126 articulations of conduct required from activities related to data reuse for research. In turn, dedicated legislation could provide a greater degree of certainty for researchers and custodians than the current legislative ‘patchwork’ which must be interpreted. As we considered above, the wide scope of the current Directive contains but a few mere exemptions which directly relate to the processing of data for health research purposes and lack clarity around key concepts such as pseudonymisation and personal data. Like principle-based approaches, rule-based approaches also have some shortcomings, most notably in their rigidity and the impossibility of anticipating and thus legislating for absolutely every possible eventuality.127 It is proposed here that a dedicated working party, new legislation, in tandem with a set of clear guiding principles might be considered as options to improve the status quo. Such a dual-approach would allow more prescriptive legislation and overarching principles to tend to the respective short-falls of each other. In particular, rules can offer clear and definitive guidance where possible, and principles can offer flexibility for those issues which require more (and inevitable) discretion on the part of decision-makers. As has been acknowledged earlier in this article, there are some cultural issues around sharing which legislation alone cannot overcome alone, however including clear articulations within legislation that enables and promotes important reuse of data for patient safety can act as a driver for cultural change in attitudes to and confidence around data sharing and use. Eur J Health Law. Author manuscript; available in PMC 2014 November 25.

Sethi

Page 13

5.3 Openness of Data: Additional Consideration


The recently approved Clinical Trials Regulation128 attempts to encourage more transparency and openness of data. The new Regulation will require detailed and plain language summaries of clinical trial data to be posted on a database set up and run by the European Medicines Agency, these summaries and final trial reports will also be freely and publicly accessible on a central database. The major UK funding councils have recently begun explicitly to push the Open Access agenda whereby data and results must be available to the research community who may wish to verify research findings. This necessarily implicates data sharing and some funding is conditional upon these terms being fulfilled. It is worthwhile considering whether and if so, how European data protection legislation will progress towards promoting transparency and openness in the same way that the new Clinical Trials Regulation aspires to. It is also worth asking whether and if so, how the research community will be guided in terms of adhering to Open Access requirements whilst simultaneously negotiating with the current ill-fitting Directive. It also remains to be seen how the demands of a future Data Protection Regulation will sit alongside aspirations to create ‘a second open science revolution.’129

6 Conclusion


This article has highlighted the clear and pressing need for a shift in data protection legislation to explicitly recognise the value in and importance of data reuse in research. Neither the current EuDPD nor the proposed Albrecht amendments to the Draft Regulation adequately reflect this need. The important principle of promoting sharing is overshadowed by the need to protect privacy. Compromising privacy is by no means advocated or suggested by this author. It is clear that ‘data sharing is not in opposition to privacy and should be conducted in a responsible way such that it does not infringe on the privacy rights of individuals and groups’.130 The key message here is that there is a need to realign the current legislative regime in order to enable responsible reuse of health data for research. One can sympathise with those charged with drafting the regulation, which must extend across the European Union and given the array of stake-holders and data-related activities which must be regulated. This formidable legislative undertaking does not however abrogate the fact that important activities may be hampered significantly, a concern reflected amongst the research community in their consideration of the proposed amendments.131 Pharmacoepidemiological studies may particularly suffer if proposals are adopted to consider pseudonymised data as ‘personal data’, to require consent, and where this is not possible, to require exceptionally high public interest thresholds must be satisfied. Due urgency is not being granted to facilitating pharmacoepidemiological studies and those studies relying on data reuse for health research more broadly. The legislative landscape must reorientate towards promoting and enabling reuse of health data for research. We must acknowledge that the law can take significant steps in reshaping the regulatory landscape, but cultural attitudes and practices towards data reuse play an undeniable role and can be equally difficult to change.132 It is argued here that having clear legislative articulations dedicated to the specific context of data reuse is a necessary starting point and cultural change is unlikely to occur without explicit reference to the need for sharing data for Eur J Health Law. Author manuscript; available in PMC 2014 November 25.

Sethi

Page 14


reuse in health research. The key step to liberating the research community from the shadow of uncertainty around data sharing is introducing clear and coherent legislation which explicitly recognises the value of data linkage upfront and encourages ethically and legally robust data sharing. This legislation should be coupled with the establishment of a dedicated working party tasked with considering issues specific to the context of data reuse in health research and with establishing guiding principles, which at the very least, could provide timely, meaningful and practical signposts on the specific issues related to reuse of data for health research. At best, these solutions could help us get back on track to realising the potential which data reuse has for securing patient safety.

Acknowledgments This work was supported by the Wellcome Trust through the Scottish Health Informatics Programme (SHIP) Grant (Ref WT086113). SHIP is collaboration between the Universities of Aberdeen, Dundee, Edinburgh, Glasgow and St Andrews and the Information Services Division of NHS Scotland. I would like to thank Wellcome for their support and Prof. Graeme Laurie for his helpful comments.

References


1. Lowrance W. Learning from experience: privacy and the secondary use of data in health research. Journal of Health Services Research & Policy. 2003; 8(2):2–7. [PubMed: 12869330] 2. Strom, B.; Kimmel, S.; Hennessy, S., editors. Textbook of Pharmacoepidemiology. second edition. Wiley; Chichester: 2013. p. 3 3. Prime Vigilance. [Retrieved 16 January 2014] Epidemiology and Pharmacoepidemiology in relation to Pharmacovigilance. 2014. www.primevigilance.com/information-and-resources/complexities-indrug-safety/epidemiology-and-pharmacoepidemiology-in-relation-to-pharmacovigilance 4. Medicines and Healthcare products Regulatory Agency. [Retrieved 7 January 2014] Information for healthcare professionals: Adverse drug reactions. 2013. www.mhra.gov.uk 5. Note that this distinction between the pre and post-marketing phase is important for the purposes of the present discussion because it is posited that pharmacoepidemiological studies, which involve the reuse of data and involve data linkage methods (considered further below) are important for patient safety but that they are not granted due importance within the legislative framework, in comparison with pre-marketing studies. This will become clearer in due course. 6. Härmark L, van Grootheest AC. Pharmacovigilance: methods, recent developments and future perspectives. European Journal of Clinical Pharmacology. 2008; 64:743–752. 745. [PubMed: 18523760] 7. Thalidomide was used to treat morning sickness in pregnant mothers and resulted in thousands of babies being born with congenital deformities. McBride W. Thalidomide and congenital malformations. Lancet. 1961; 2:1358. 8. These amendments were made to the Food, Drug and Cosmetic Act in 1962. To ensure greater drug safety, drug manufacturers had to prove the efficacy of drugs prior to marketing. Greene J, Podolsky S. Reform, Regulation and Pharmaceuticals — The Kefauver-Harris Amendments at 50. New England Journal of Medicine. 2012; 367:1481–1483. [PubMed: 23075174] 9. Rägo, L.; Santoso, B. Drug Regulation: History, Present and Future. In: van Boxtel, C.; Santoso, B.; Edwards, I., editors. Drug Benefits and Risks: International Textbook of Clinical Pharmacology. 2nd edition. IOS Press; Uppsala Monitoring Centre: 2008. p. 66 10. Council Directive 65/65/EEC of 26 January 1965 on the approximation of provisions laid down by law, regulation or administrative action relating to medicinal products (OJ L No 22 of 9. 2. 1965, p. 369). (As amended by Directives 66/454/EEC, 75/319/EEC, 83/570/EEC, 87/21/EEC, 89/341/EEC 89/342/EEC 89/343/EEC, 92/27/EEC, 92/73/EEC et 93/39/EEC). 11. With most recent legislative provisions including Directive 2010/84/EU amending, as regards pharmacovigilance, Directive 2001/83/EC and Regulation 1235/2010 amending, as regards pharmacovigilance, Regulation No. 726/2004.


Sethi

Page 15

Europe PMC Funders Author Manuscripts Europe PMC Funders Author Manuscripts

12. See for example: The University of Manchester. [Retrieved 26th March 2014] Centre for Pharmacoepidemiology and Drug Safety. www.pharmacy.manchester.ac.uk/cpdsThe Spanish Medicines Agency. [Retrieved 26th March 2014] Agencia Española de medicamentos y productos sanitaros. www.aemps.gob.es/en/home.htm [Retrieved 26th March 2014] Agence nationale de sécurité du medicament et des produits de santé. ansm.sante.fr/Declarer-un-effetindesirable/ Pharmacovigilance/Organisation-de-la-pharmacovigilance-nationale/(offset)/0 13. At a European level, the European Medicines Agency has established ENCePP (the European Network of Centres for Pharmacoepidemiology and Pharmacovigilance) ‘to further strengthen the post-authorisation monitoring of medicinal products in Europe’ European Network of Centres for Pharmacoepidemiology and Pharmacivigilance. [Retrieved 21 January 2014] What is ENCePP?. 2014. www.encepp.eu/structure/index.shtml 14. Avery, A., et al. Evaluation of patient reporting of adverse drug reactions to the UK ‘Yellow Card Scheme’: literature review, descriptive and qualitative analyses, and questionnaire surveys. NIHR HTA; Southampton: 2011. Technical Report: DOI: 10.3310/hta15200 See also [Retrieved 25 March 2014] MHRA Yellow Card Scheme website. yellowcard.mhra.gov.uk 15. Sun A, et al. Unplanned medication discontinuation as a potential pharmacovigilance signal: a nested young person cohort study. BMC Pharmacology and Toxicology. 2014; 15(11) 16. Often, ADR detection is carried out through spontaneous reporting, discussed in more detail below, and commonly referred to as pharmacovigilance. Somewhat confusingly, pharmacovigilance and pharmacoepidemiology are sometimes referred to interchangeably. 17. Shields K, Lyerly A. Exclusion of pregnant women from industry-sponsored clinical trials. Obstet Gynecol. 2013; 122(5):1077–1081. [PubMed: 24104789] 18. Bourgeois F, et al. Pediatric versus adult drug trials for conditions with high pediatric disease burden. Pediatrics. 2012; 130(2):285–292. [PubMed: 22826574] 19. Murdo M, et al. Improving recruitment of older people to research through good practice. Age and Ageing. 2011; 40(6):659–665. [PubMed: 21911335] 20. Van Spall H, et al. Eligibility Criteria of Randomized Control Trials Published in High-Impact General Medical Journals. Journal of the American Medical Association. 2007; 297(11):1233– 1240. [PubMed: 17374817] 21. Supra note 6. 22. Heiat A, Gross C, Krumholz H. Representation of the Elderly, Women, and Minorities in Heart Failure Clinical Trials. Archives of Internal Medicine. 2002; 162(15):1682–1688. [PubMed: 12153370] 23. See for example: Schneeweiss S, et al. Admissions caused by adverse drug events to internal medicine and emergency departments in hospitals: a longitudinal population-based study. European Journal of Clinical Pharmacology. 2002; 58:285–291. [PubMed: 12136375] Niklas Noren G, Edwards R. Modern methods of pharmacovigilance: detecting adverse effects of drugs. Clinical Medicine. 2009; 9(5):486–489. [PubMed: 19886114] 24. Jadad A, Matthew T. Consideration of Multiple Chronic Diseases in Randomized Control Trials. Journal of the American Medical Association. 2011; 306(24) 25. For example, from over the counter to prescription-only accessibility. 26. Ban T. The Role of Serendipity in Drug Discovery. Dialogues Clinical Neuroscience. 2006; 8(3): 335–344. 27. Ashburn T, Thor K. Drug repositioning: identifying and developing new uses for existing drugs. National Review of Drug Discovery. 2004; 3:673–683.Goldstein I, et al. Oral Sildenafil in the Treatment of Erectile Dysfunction. New England Journal of Medicine. 1998; 338:1397–1404. [PubMed: 9580646] 28. Ashburn and Thor, ibid. 29. Knoppers B, et al. A human rights approach to an international code of conduct for genomic and clinical data sharing. Human Genet. 2014 www.ncbi.nlm.nih.gov/pubmed/24573176. 30. Indicated by the inverted black triangle symbol on the packet. 31. General Medical Council. [Retrieved 8 April 2014] Good practice in prescribing and managing medicines and devices. Jan 31. 2013 www.gmcuk.org/guidance/ethical_guidance/14316.asp 32. The Medicines and Healthcare Products Regulatory Agency Yellow Card Scheme Eur J Health Law. Author manuscript; available in PMC 2014 November 25.

Sethi

Page 16


33. See MHRA. [Retrieved 28 March 2014] Black Triangle Scheme — new medicines and vaccines subject to EU-wide additional monitoring. 2014. www.mhra.gov.uk/Safetyinformation/ Howwemonitorthesafetyofproducts/Medicines/BlackTriangleproducts/index.htm 34. Hazell L, Shakir S. Under-Reporting of Adverse Drug Reactions; A Systematic Review. Drug Safety. 2006; 29(5):385–396. [PubMed: 16689555] 35. Ibid., p. 394. 36. Eland I, et al. Attitudinal survey of voluntary reporting of adverse drug reactions. Journal of Clinical Pharmacology. 1999; 48(4):623–627. 37. Williams D, Feely J. Underreporting of adverse drug reactions: attitudes of Irish doctors. Ir J Med Sci. 1999; 168:257–261. [PubMed: 10624366] Backstrom M, et al. Attitudes to reporting adverse drug reactions in northern Sweden. European Journal of Clinical Pharmacology. 2000; 56:729– 732. [PubMed: 11214784] 38. Supra note 34. 39. Herdeiro M. Physicians’ Attitudes and Adverse Drug Reaction Reporting. Drug Safety. 2006; 28(9):825–833. [PubMed: 16119975] 40. Bäckström M, Mjörndal T, Dahlqvist R. Under-reporting of serious adverse drug reactions in Sweden. Pharmacoepidemiology and Drug Safety. 2004; 13(7):483–487. [PubMed: 15269932] 41. British Medical Association Board of Science. Reporting adverse drug reactions: A guide for healthcare professionals. May. 2006 42. Even where ADRs are reported, establishing that a particular drug is directly associated with a reaction is not a simple process, particularly where a patient may already be feeling ill and it might be difficult to differentiate between an ADR and a symptom of the patient’s illness. 43. Arlett P, Kurz X. New approaches to strengthen pharmacovigilance. Drug Discovery Today: Technologies. 2011; 8(1):e15–e19. 44. Jackson, E. Law and the Regulation of Medicines. Hart Publishing; Oxford: 2012. p. 99 45. Supra note 6, p. 746. 46. Light, D. Bearing the Risks of Prescription Drugs. In: Light, D., editor. The Risks of Prescription Drugs. Columbia University Press; 2010. p. 1-39.7 47. Brook E, Rosman D, Holman C. Public good though data linkage: measuring research outputs from the Western Australian Data Linkage System. Australian and New Zealand Journal of Public Health. 2008; 32(1):19–23. [PubMed: 18290908] 48. Examples of routine data include mortality data cancer registries, hospital episodes data, and infectious disease data. 49. I.e. recall bias or interview bias, drop outs and completeness of response may be reduced’. Jönsson, A. Drug-related morbidity and mortality: Pharmacoepidemiological aspects. Linköping University Medical Dissertations No. 1030; Linköping: 2007. www.diva-portal.org/smash/get/diva2:17207/ FULLTEXT01 [Retrieved 23 January 2014] 50. Lowrance, W. Learning from Experience: Privacy and the Secondary Use of Data in Health Research (Report). The Nuffield Trust; 2002. p. 6 51. Coorevits P, et al. Electronic health records: new opportunities for clinical research. Journal of Internal Medicine. 2013; 274:547–560. [PubMed: 23952476] 52. A UK example is the Clinical Practice Research Datalink (CPRD) in the UK This was previously known as the General Practice Research Database. For more information see [Retrieved 28 March 2014] CPRD website. www.cprd.com/intro.asp 53. Pharmo Record Linkage system as developed in the Netherlands. See [Retrieved 28 March 2014] Pharmo Institute for Outcomes Research. www.pharmo.nl 54. [Retrieved 7 April 2014] Electronic Health Records for Clinical Research (EHR4CR). See EHR4CR website, www.ehr4cr.eu 55. Medical Research Council. [Retrieved 29 August 2012] E-Health Informatics Research Centres Call. 2012. www.mrc.ac.uk/Fundingopportunities/Calls/E-healthCentresCall/index.htm 56. For more information, see The Farr Institute. [Retrieved 9 January 2014] 2014. www.farrinstitute.org


Sethi

Page 17


57. Laurie, G.; Sethi, N. Information Governance of Use of Health-Related Data in Medical Research in Scotland: Current Practices and Future Scenarios. University of Edinburgh School of Law; 2011. Working Paper No 2011/26 58. Academy of Medical Sciences. Personal data for public good: using health information in medical research. 2011Academy of Medical Sciences. A new pathway for the regulation and governance of health research. 2012Thomas R, Walport T. Data Sharing Review Report. 2008 59. See for example: European Commission. Commission Staff Working Paper Impact Assessment. Brussels. Jan 25.2012 :13. (SEC2012) 72 final. Robinson, N., et al. Review of the European Data Protection Directive. RAND; Europe: 2009. Technical Report Sponsored by the Information Commissioner’s OfficeICO; Privacy in Research Ethics & Law (PRIVIREAL) Project. [Retrieved 7 April 2014] www.privireal.org 60. Supra note 58. 61. Witham, M., et al. [Retrieved 5 April 2014] Construction of a linked health and social care database resource — lessons on process, content and culture. Informatics for Health and Social Care. 2014. www.ncbi.nlm.nih.gov/pubmed/24650248 62. Academy of Medical Sciences. Personal data for public good: using health information in medical research. 2006 63. El Emam, K.; Arbuckle, L. Anonymizing Health Data. O’Reilly Media; USA: 2013. p. 2 64. Narayanan A, Schmatikov V. Myths and fallacies of “Personally Identifiable Information”. Communications of the ACM. 2010; 53(6):24–26. 65. Ohm P. Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization. UCLA Law Review. 2010; 57:1701.U of Colorado Law Legal Studies Research Paper No. 9-12 66. Fullerton S, et al. Meeting the governance challenges of next-generation biorepository research. Science Translational Medicine. 2010; 2(15) 67. The Royal Society. Science as an Open Enterprise. 2012. The Royal Society Science Policy Centre report 02/12 68. See for example approach in UK Information Commissioner’s Office. Anonymisation: Managing Data Protection Risk: Code of Practice. 2012:12. 69. Ibid. 70. Pommerening K, Reng M. Secondary use of the EHR via pseudonymisation. Studies in Health Technology and Informatics. 2004; 103:441–446. [PubMed: 15747953] 71. Lo Iacono L. Multi-centric Universal Pseudonymisation for Secondary Use of the HER. Studies in Health Technology and Informatics. 2007; 126:239–247. 239. [PubMed: 17476066] 72. Supra note 68, at p. 49. 73. Tinabo, R., et al. Anonymisation vs. Pseudonymisation: Which one is most Useful for both Privacy Protection and Usefulness of E-healthcare Data?. Proc. IEEE 4th International Conference for Internet Technology and Secured Transactions (ICITST); 2009; ieeexplore.ieee.org/xpls/ abs_all.jsp?arnumber=5402501&tag=1 74. Ibid. 75. House of Commons Health Committee. The Electronic Patient Record Sixth Report of Session 2006-07. 1:91. HC 422-I. Iain, Bourne; Information Commissioner’s Office (ICO). The Complexities of Privacy and Anonymity XRDS: Crossroads. The ACM Magazine for Students. 2013; 20(1):27–31. ACM New York, NY, USA. 76. Ibid. (at p. 91). 77. UK Information Commissioner’s Office. [Retrieved 7 April 2014] Proposed draft EU General Data Protection Regulation and ‘law enforcement. Directive. Comparative analysis of the European Commission text and the European Parliament’s LIBE (civil liberties) Committee amendments. http://ico.org.uk/news/blog/2013/~/media/documents/library/Data_Protection/ Research_and_reports/Proposed-draft-EU-General-Data-Regulation-and-law-enforcementDirective-20140124.pdf 78. Supra note 68. 79. Ibid.


Sethi

Page 18


80. See for example: Journal of American Medical Informatics Association. doi:10.1136/ amiajnl-2012-001575. 81. See Laurie G, Sethi N. Towards Principles-Based Approaches to Governance of Health-related Research using Personal Data. European Journal of Risk Regulation. 2013; 1:43–57. [PubMed: 24416087] Sethi N, Laurie G. Delivering proportionate governance in the era of eHealth: Making linkage and privacy work together. Medical Law International. 2013; 13(2-3):168–204. [PubMed: 24634569] 82. Wellcome Trust. [Retrieved 29 March 2014] Impact of the draft European Data Protection Regulation and proposed amendments from the rapporteur of the LIBE committee on scientific research. May. 2013 www.wellcome.ac.uk/stellent/groups/corporatesite/ @policy_communications/documents/web_document/wtvm054713.pdf 83. European Parliament. [Retrieved 29 March 2014] Q&A on EU data protection reform. Mar 4. 2014 www.europarl.europa.eu/pdfs/news/expert/background/ 20130502BKG07917/20130502BKG07917_en.pdf 84. For discussion see: Birnhack M. The EU Data Protection Directive: An engine of a global regime. Computer Law & Security Review. 2008; 24(6):508–520.Schwartz P. European Data Protection Law and Restrictions on International Data Flow. Iowa Law Review. 1995; 80:471. 80. 85. Wong R. The Shape of Things to Come: Swedish Developments on the Protection of Privacy. SCRIPTed. 2005; 2(1):98–113. 86. European Parliament News. [Retrieved 17 March 2014] QA on Data Protection Reform. Mar 4. 2014 www.europarl.europa.eu/news/en/news-room/content/20130502BKG07917/html/QA-onEU-data-protection-reform 87. European Commission. Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Brussels. Jan 25.2012 12 COM. 11 final 2012/0011 (COD). 88. Directive 2010/84/EU and Regulation (EU) No 1235/2010 impose obligations on pharmaceutical companies to report adverse events however it has not always been clear how those legislation interact with the EU Data Protection Directive. The Draft Data Protection Regulation specifies that health data may be processed for ‘ensuring high standards of quality and safety for medicinal products and product safety’ thus potentially providing a clearer legislative base for the use of personal data and the retention of data for research. See: International Pharmaceutical Privacy Consortium. [Retrieved 7 April 2014] Comments in response to the call for evidence on EU Data Protection Proposals. Mar. 2012 www.pharmaprivacy.org/download/IPPC%20Comments%20UK %20Consultation%20on%20Proposed%20Data%20Protection%20Regulation.pdf 89. Rapporteur Jan Philipp Albrecht, Committee on Civil Liberties, Justice and Home Affairs, Draft Report on the proposal for a regulation of the European Parliament and of the Council on the protection of individual with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) COM (2012) 0011 — C7-0025/2012 — 2012/0011(COD)). 90. Ploem M, Stronks K. Proposed EU data protection regulation is a threat to medical research. British Medical Journal. 2013; 346:f3534. [PubMed: 23729429] and supra note 82 91. Fears R, et al. Data protection regulation and the promotion of health research: getting the balance right. Quarterly Journal of Medicine. 2014; 107:3–5. 92. Supra note 87 (Explanatory Memorandum, Para. 1). 93. Ibid. 94. Emphasis added. 95. Emphasis added. 96. European Parliament, Committee on Civil Liberties, Justice and Home Affairs, 2012/0011(COD), Draft Report on the proposal for a regulation of the European Parliament and of the Council on the protection of individual with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (COM (2012)0011 — C7-0025/2012 — 2012/0011(COD)) Amendment 327 Proposal for a regulation Article 81 — paragraph 2, Hereafter referred to as ‘Albrecht Report’.


Sethi

Page 19


97. Regidor E. The use of personal data from medical records and biological materials: ethical perspectives and the basis for legal restrictions in health research. Social Science and Medicine. 2004; (54):1975–1894. 1976. [PubMed: 15312931] Furness P, Nicholson L. Obtaining Explicit Consent for the Use of Archival Tissue Samples: Practical Issues. Journal of Medical Ethics. 2004; 20:561. [PubMed: 15574445] 98. Laurie G. Evidence of support for biobanking practices. British Medical Journal. 2008; 337:337. [PubMed: 18617495] Laurie G, Postan E. Rhetoric or Reality: What is the legal status of the consent form in health-related research? Medical Law Review. 2013; 21(3):371–414. [PubMed: 23055572] 99. Supra note 82, Supra note 90 Andersen M, Storm H. Cancer registration, public health and the reform of the European data protection framework: Abandoning or improving European public health research? European Journal of Cancer. 2013 100. Supra note 77. 101. Article 29 Data Protection Working Party, Opinion 05/2014 on Anonymisation Techniques, 0829/14/EN WP216, adopted 10 April 2014. 102. Supra note 82. 103. Supra note 77. 104. Albrecht Report, Amendment 328, Proposal for a regulation Article 81 — paragraph 2 a (new). 105. Draft Regulation Article 42. 106. Albrecht Report, Amendment 27 Proposal for a regulation Recital 42. 107. Gymrek M, et al. Identifying personal genomes by surname inference. Science. 2013; 339:321– 324. [PubMed: 23329047] 108. Supra note 64. 109. Supra note 61. 110. European Commission. [Retrieved 29 March 2014] Article 29 Working Party. ec.europa.eu/ justice/data-protection/article-29/index_en.htm. 111. Article 29 Data Protection Working Party, Opinion 15/2011 on the definition of consent, Adopted 13 July 2011. 112. Article 29 Data Protection Working Party, Opinion 1/2010 on the concepts of ‘controller’ and ‘processor’, 00264/10/EN, WP 169, adopted 16 February 2010. 113. Article 30 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. 114. Honderich, T., editor. The Oxford Companion to Philosophy. Oxford University Press; Oxford: 1995. p. 719 115. Supra note 81. 116. Ibid. 117. For more see SHIP website. Retrieved 31 March 2014, www.scot-ship.ac.uk. 118. See scotland.gov.uk/Topics/Statistics/datalinkageframework. Retrieved 7 April 2014. 119. Supra note 81. 120. Ibid. 121. Knoppers B, et al. Towards a data sharing Code of Conduct for international genomic research. Genome Medicine. 2011; 46(3):4. 122. Sama L, Shoaf V. Reconciling Rules and Principles: An Ethics-Based Approach to Corporate Governance. Journal of Business Ethics. 2005; 58:1. and supra note 84 (Towards Principles). 123. See for example, Harris J. In praise of unprincipled ethics. Journal of Medical Ethics. 2003; 29(5):303–306. [PubMed: 14519841] 124. See for example: Danner Clouser K, Gert B. A Critique of Principlism. Journal of Medical Philosophy. 1990; 15:219–236.Muirhead W. When four principles are too many: bloodgate, integrity and an action-guiding model of ethical decision making in clinical practice. Journal of Medical Ethics. 2012; 38:195–196. [PubMed: 22074770]


Sethi

Page 20


125. For discussion on rule-based and principle-based regulation, see: Kern, A.; Moloney, N. Law Reform and Financial Markets. Edward Elgar Publishing; Cheltenham: 2011. p. 8Black, J. The Rise, Fall and Fate of Principles Based Regulation. Vol. 17. LSE Law Society and Economy Working Papers; 2010. 126. Braithwaite J. Rules and Principles: A Theory of Legal Certainty. Australian Journal of Legal Philosophy. 2002; 27 127. Arjoon S. Striking a Balance Between Rules and Principles-based Approaches for Effective Governance: A Risk-based Approach. Journal of Business Ethics. 2006; 68:53, 65. et seq. 128. Regulation (EU) No …/2014 of the European Parliament and of the Council on clinical trials on medicinal products for human use, and repealing Directive 2001/20/EC. 129. Supra note 68. 130. Supra note 29. 131. Supra notes 82 and 90. 132. See for example: Journal of the American Medical Informatics Association. doi:10.1136/ amiajnl-2012-001575.

Europe PMC Funders Author Manuscripts Eur J Health Law. Author manuscript; available in PMC 2014 November 25.

Data sharing in the undiagnosed diseases network.

Sharing Clinical Trial Data.

Data sharing matters.

Sharing big biomedical data.

Sharing Big Data.

Practice-Based Research Networks: Integrating Clinical Data for Improved Pharmacoepidemiology.

Sharing of Medicare claims data.

Bodies of Data: Genomic Data and Bioscience Data Sharing.

Sharing my health data: a survey of data sharing preferences of healthy individuals.

Sharing Public Health Research Data: Toward the Development of Ethical Data-Sharing Practice in Low- and Middle-Income Settings.

Sharing your thoughts about sharing clinical trial data.

Genetic data sharing and privacy.

What drives academic data sharing?

Data sharing as an issue.

Evolving Research Data Sharing Networks to Clinical App Sharing Networks.

Addressing Global Data Sharing Challenges.

Researchers oppose data-sharing proposal.

Cancer-gene data sharing boosted.

knowledge sharing in global genomic studies.

Open access data sharing in genomic research.

Global Data Sharing in Alzheimer Disease Research.

Relevance of pharmacoepidemiology to Nepal.

Sharing of Medicare claims data--reply.

OpenfMRI: Open sharing of task fMRI data.